CVE-2015-1427 – The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x befor

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1427

Reference (s):

• BID:72585
• URL: http://www.securityfocus.com/bid/72585
• BUGTRAQ:20150211 Elasticsearch vulnerability CVE-2015-1427
• URL: http://www.securityfocus.com/archive/1/534689/100/0/threaded
• http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/